lateral movement service from admin share
Detects remote service creation where the service binary is launched from an SMB administrative share (ADMIN$ or C$), indicating potential PsExec-style lateral movement.
YARA-L
Detects remote service creation where the service binary is launched from an SMB administrative share (ADMIN$ or C$), indicating potential PsExec-style lateral movement.
Already have an account?